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This action is responsive to the amendment and remarks file on 1 1/30/07. 
Claims 1-39 are presented for further examination. 

101 rejection is now withdrawn on Claim 22 due to the claim amendment. 
DETAILED ACTION 
Response to Arguments 

Applicant's arguments with respect to claims 1-39 have been considered but are moot in 
view of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 1-19 and 21-36 are rejected under 35 U.S.C. 103(a) as being unpatentable over 

Sharon et al hereinafter Sharon (US 6,137,782) and Elliott et al hereinafter Elliott (US. 

6,754,181). 

1. Referring to Claims 1, 23 and 39, Sharon indicates an application monitoring system (refer to 
abstract), comprising: (a) at least one media module (agent, network element, refer to Col 4, 
Lines 5-20, Col 3, Lines 40-67) coupled to an associated network segment (refer to Col 5, Lines 
9-25) on which a network application is running (refer to Col 3, Lines 50-67), each media 
module is adapted and configurable (media module comprises agents which are configurable, 
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refer to Col 5, Lines 10-25, Col 6, Lines 1-20, Col 7, Lines 40-67) for monitoring and collecting 
data relating to traffic (refer to Col 2, Lines 1-35) on the associated network segment 
corresponding to the network application (software packages, refer to Col 1, Lines 54-67) and for 
analyzing, responsive to a trigger condition (instruction, received from the CME, refer to Col 6, 
Lines 1-5) the collected data for traffic information (refer to Col 3, Lines 50-67 and Col 5, Lines 
5-15), wherein each media module is tailored for network analysis (38, refer to Fig 2 and 
Abstract) and is configurable to a monitoring mode or a focus mode to monitor and collect data 
(refer to Col 6, Lines 45-67, Col 7, Lines 1-9) ; and (b) an application server module (CME, refer 
to Col 3, Lines 25-55) coupled to the at least one media module (network elements, agents, refer 
to Col 3, Lines 25-55) for receiving the collected data and the analyzed data (refer to Col 6, 
Lines 35-67 and Col 7, Lines 1-25) and the analyzing the data for improving the performance of 
the network application (software packages, refer to Col 1, Lines 50-67, Col 2, Lines 55-67; 
reducing the redundancy of collected data, refer to Col 5, Lines 5-25, which reduce unnecessary 
processing time by the CME) and for configuring the trigger condition and for transmitting the 
trigger condition to the at least one media module (refer to Col 6, Lines 1-20, and Col 7, Lines 5- 
22 and Lines 40-67); modifying a trigger condition indicating when to collect and analyze the 
data (each time data packet is transmitted through network, is the condition, refer to Col 6, lines 
1-20). 

Although Sharon disclosed the invention substantially as claimed, Sharon is silent regarding "the 
application server module associating a user with the collected data and the analyzed data and 
generating a user specific log file including the collected data, the analyzed data and the 
associated user". 
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Elliott, in an analogous art disclosed "the application server module associating a user with the 
collected data and the analyzed data and generating a user specific log file including the 
collected data, the analyzed data and the associated user" (refer to Col 63, 64 and 65, Col 107, 
Lines 45-67, and Process Event 402, refer to Col 109, Lines 45-67, and SS7's signal is related to 
network traffic with the user interface server; storing logging information refer to Col 37, Lines 
35-67). 

Hence, providing functions disclosed by Elliott, would be desirable to make the system even 
more flexible to incorporate the accounting system within the Sharon's system, also, it would be 
easier for the network management to have all the separate functions to be managed by each 
individual manager and process at the same time (multithread, refer to Col 8) in order to decrease 
the processing time 

Therefore, at the time of the invention, it would have been obvious to one of ordinary skill in the 
art to modify the system of Sharon by including the features taught by Elliott. 

2. Referring to Claims 2 and 24, Sharon indicates wherein the application server module (central 
communication server, 20, refer to Fig 1) provides (refer to Col 7, Lines 55-67) at least one of a 
user interface, provisioning, reports, alarms, statistics, and an SNMP agent (refer to Col 1, Lines 
35-55). 



3 Referring to Claims 3 and 25, Sharon indicates wherein the user interface (GUI 28, refer to Col 
10, Lines 55-67) is accessible via Internet connection (refer to Col 8, Lines 10-25 and Col 10, 
Lines 14-65). 
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4. Referring to Claim 4, Sharon indicates wherein the at least one media module (agent, network 
element, refer to Col 4, Lines 5-20, Col 3, Lines 40-67) includes at least two media modules of 
different types (agents "D" and "C", receiving information, analyzing information, refer to Col 4, 
Lines 5-20 and Col 1 1, Lines 20-50). 

5. Referring to Claims 5 and 27, Sharon discloses further comprising at least one additional 
media module (agent, network element, refer to Col 4, Lines 5-20, Col 3, Lines 40-67) that 
monitors network traffic not related to the network application (refer to Col 1, Lines 54-67). 

6. Referring to Claim 6, Sharon indicates wherein multiple media modules (agent 14, refer to Fig 
1) are coupled to a common chassis (CME, 12, refer to Fig 1). 

7. Referring to Claim 7, Sharon indicates wherein the system is self-managed (automatic, refer to 
abstract). 

8. Referring to Claim 8, Sharon indicates wherein the system is remotely upgradeable (software 
are upgradeable, refer to Col 2, Lines 55-67 and Col 1, Lines 54-67). 

9. Referring to Claims 9 and 28, Sharon indicates wherein the application server module 
provides expert functions when analyzing the data (refer to Col 5, Lines 1-35 and Col 7, Lines 1- 
40). 
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10. Referring to Claim 10 and 29, Sharon indicates wherein the application server module (CME, 
refer to Col 3, Lines 25-55 and Col 5, Lines 40-67) performs a security analysis (topology 
mapping, which is inherent that it consists a security/reliability functions, refer to Col 5, lines 1- 
35) based on the data. 

1 1. Referring to Claims 1 1 and 30, Sharon indicates wherein the application server module 
(CME, refer to Col 3, Lines 25-55, Col 5, Lines 40-67) performs policy management functions 
(topology mapping, which is inherent that it also indicates where the packets are routed to, refer 
to Col 5, lines 1-35) when analyzing the data. 

12. Referring to Claim 14, Sharon indicates wherein the application server module detects, 
configures, manages and downloads software to the at least one media module (refer to Col 4, 
Lines 5-20, and Col 6, Lines 35-60). 

13. Referring to Claim 22, Sharon indicates a computer program product comprising a computer 
readable storage medium having computer program instructions embodied thereon for 
implementing a method for monitoring a network application (refer to Col 2, Lines 25-55), 
comprising: 

(a) monitoring and collecting data relating to traffic on a network segment corresponding to a 
network application (software packages, refer to Col I, Lines 54-67) and for analyzing the 
collected data for traffic information (refer to Col 6, Lines 35-67 and Col 7, Lines 1-25) utilizing 



Application/Control Number: 10/043,501 Page 7 

Art Unit: 2151 

a configurable (media module comprises agents which are configurable, refer to Col 5, Lines 10- 
25, Col 6, Lines 1-20, Col 7, Lines 40-67) media module tailored for network analysis (refer to 
Col 6, Lines 18-67); (b) reiving the data (refer to Col 6, Lines 1-20); and (c) analyzing the 
collected data and the analyzed data (refer to Col 5, Lines 1-40 and Col 6, Lines 45-67 and Col 7, 
Lines 1-25) for improving the performance of the network application utilizing an application 
server module (refer to Col 5, Lines 1-40). (d) modifying a trigger condition indicating when to 
collect and analyze the received data (refer to Col 6, Lines 1-20). (e) configuring the media 
module in response to the analyzed data (refer to Col 7, Lines 40-67). 

14. Referring to Claims 13 and 32, Sharon indicates the server module the usage of software 
(server computers, refer to Col 3, Lines 25-55, and software packages, refer to Col 1, Lines 54- 
67) wherein trigger scripts (it is inherent that software package consists trigger scripts to analysis 
data) are used to customize the analysis of the data (refer to Col 5, Lines 1-10). 

15. Referring to Claim 15, Sharon indicates wherein the at least one media module (agents 14, 
refer to Col 10, Lines 4-15) preprocesses the data (gathered traffic data information, refer to Col 
6, Lines 35-67) prior to receipt of the data by the application server module. 

16. Referring to Claim 16, Sharon indicates wherein the application server module includes a 
user interface server for managing interactions with a user (refer to Col 10, Lines 14-65), an 
object repository coupled to the user interface server for storing objects (refer to Col 10, Lines 
55-65), a configuration manager coupled to the user interface server for providing access to the 
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objects (GUI thread 30, refer to Col 10, Lines 55-67), a remote network monitoring services 
subsystem (agent 14, refer to Col 11, Lines 1-15) coupled to the user interface system for 
providing remote access to the objects (traffic flow pattern, refer to Col 10, Lines 15-67), an 
expert server coupled to the object repository for analyzing data received from a media module 
(CME 12, refer to Col 45-67), and an administrative services subsystem coupled to the user 
interface server for providing administrative functions involving the objects (LMAP, refer to Col 
10, Lines 55-67). 

17. Referring to Claim 18, Sharon indicates wherein the at least one media module includes a 
data collection module for collecting data from a network segment (refer to Col 6, Lines 1-20) 
and prepending the data with descriptor information (CME 12, refer to Col 6, Lines 1-20), a flow 
processor for classifying the collected data into a plurality of flows (refer to Col 6, Lines 60-67), 
a capture buffer (queue, refer to Col 8, Lines 39-60) coupled to the flow processor (main thread 
22) for filtering (refer to Col 8, Lines 38-60) and buffering the collected data in accordance with 
the flow processor, and a main processor for processing the collected data (LMAP module 18, 
refer to Col 8, Lines 38-60). 

18. Referring to Claim 35, Sharon indicates prepending the data collected from the network 
segment with descriptor information (refer to Col 6, Lines 1-20), classifying the collected data 
into a plurality of flows (sort data, refer to Col 7, Lines 1-10), filtering and buffering the 
collected data in accordance with the flow processor (data parser 34, refer to Col 7, Lines 1-10), 
and processing the collected data (analyzer, refer to Col 7, Lines 5-55). 
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19. Referring to Claim 26, Sharon indicates further comprising simultaneously monitoring 
(multithread, refer to Col 8, Lines 39-50) different types of data (highest data rates to lowest, 
refer to Col 10, Lines 35-47) on multiple co-located network segments. 

20. Referring to Claim 33, Sharon indicates managing interactions with a user (refer to Col 10, 
Lines 20-65), storing objects (refer to Col 10, Lines 55-65), providing access to the objects 
(display data to user, refer to Col 10), providing remote access to the objects (accessing data 
through times, refer to Col 10), analyzing data received from a media module (traffic data 
gathered by media module, refer to Col 10), and providing administrative functions involving the 
objects (filtering, refer to Col 10). 

21. Referring to Claims 21 and 38, Sharon indicates wherein the data analysis includes gathering 
performance data of the application during the monitoring (refer to Col 2, Lines 25-55 and Col 6, 
Lines 60-67); generating a set of metrics (records, refer to Col 8, Lines 40-67) in real time based 
on the performance data (refer to Col 8, Lines 39-67); and measuring a performance of the 
application from at least one of a client perspective, a server perspective, and a network 
perspective based on the metrics (refer to Col 8, Lines 10-60). 

22. Referring to Claims 12 and 31, Sharon indicates wherein the application server module 
(server computers, refer to Col 3, Lines 25-55) performs several functions (refer to Col 8, Lines 
25-67 and Col 9 and Col 10). 
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Sharon does not expressly indicate the server module indicates the accounting functions. 
Elliott discloses the accounting functions (refer to Col 24, Lines 1-25) 

At the time of the invention, it would have been obvious to a person of ordinary skillin the art to 
combine Sharon and Elliott. 

The suggestion/motivation would have been that Sharon consists of network monitoring function 
to monitor traffic (refer to Col 6, Lines 40-67). Accounting function within network is 
considered to be type of traffic, it would make the system even more flexible to incorporate the 
accounting system within the Sharon and useful. 

23. Referring to Claims 17 and 34, Sharon indicates wherein the application server module (44, 
refer to Fig 2) discloses a registry services subsystem for associating an object with at least one 
of a user and the server system (refer to Col 3, Col 4, Col 8, Col 9, and Col 10 and Fig 2) , a 
triggers manager for managing triggers (refer to Col 7), and a hardware services subsystem for 
providing communication between the server system and external modules (refer to Col 3, 4, 5 
and 6). 

Elliott discloses wherein the application server module includes at least one of a statistics 
manager for dispatching statistics, an alarm manager for dispatching alarms (refer to Col 109, 
110 and 1 1 1), an event manager for dispatching events (refer to Col 1 1 1), a capture manager 
subsystem for creating trace files (refer to Col 99 and Col 101), a session manager for managing 
a user session (refer to Col 94), a security manager for providing authorization levels to users 
(refer to Col 93 and 94 and 95). 
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At the time of the invention, it would have been obvious to a person of ordinary skill in the art to 
combine Sharon and Elliott. 

The suggestion/motivation would have been that Sharon indicates the security of the network 
system (refer to Col 6). He also indicates the usage of monitoring traffic system utilizing the 
CME 12, servers and other network elements (refer to Col 5). It would be easier for the network 
management to have all the separate functions to be managed by each individual manager and 
process at the same time (multithread, refer to Col 8). To decrease the processing time. 

24. Referring to Claims 19 and 36, Sharon indicates wherein the at least one media module 
performs filtering functions (refer to Col 6, Lines 60-67) and network segment (refer to Col 5, 
Lines 9-25). He also indicates the usage of queue for store information (refer to Col 8, Lines 35- 
60) and threshold (refer to Col 10, Lines 35-50). Sharon also define the system is able to 
determine/monitor maximum data storage (refer to Col 8, Lines 25-40). 

Sharon does not expressly indicate filtering comprising: (i.) classifying the data in the network 
segment into multiple flows; (ii.) prioritizing the flows into high and low priority flows; (iii.) 
monitoring an amount of data in the high priority flows (refer to Col 20, Lines 1-45); and (iv.) 
reallocating resources from the low priority queue to the high priority queue if the amount of 
data in the high priority flows surpasses a predetermined threshold. 

Elliott discloses usage of (i.) classifying the data in the network segment into multiple flows 
(refer to Col 19, Lines 55-67 and Col 20); (ii.) prioritizing the flows into high and low priority 
flows (priority tag and non-tagged, refer to Col 19, Lines 55-67); (iii.) monitoring flows (refer to 
Col 20, Lines 30-45); and (iv.) reallocating resources from the low priority queue to the high 
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priority queue if the amount of data in the high priority flows surpasses a predetermined 
threshold (refer to Col 26, Lines 20-67 and Col 1 1 1). 

At the time of the invention, it would have been obvious to a person of ordinary skill in the art to 
combine Sharon and Elliott. 

The suggestion and motivation for doing so would have been that Sharon indicate the system 
consists functionality of monitoring the traffic and filtered them according to the traffic data 
characteristic (refer to Col 6 and Col 7). By classify the traffic into various flows, and reallocate 
the resource as necessary, add the flexibility and can void traffic backlog within the system. 

Claims 20 and 37 rejected under 35 U.S.C. 103(a) as being unpatentable over Sharon et al 
hereinafter Sharon (US 6,137,782) in view of Sistanizadeh et al hereinafter Sistanizadeh (US 
6,681,232) 

25. Referring to Claims 20 and 37, Sharon indicates wherein the analysis of the data by the 
application server module includes creating reports (refer to Col 8, Lines 25-40) based on the 
monitored data, and output the reports to a user (refer to Col 10, Lines 35-65). 
Sharon does not expressly indicate of utilizing graphs and logs as part of the reports. 
Sistanizadeh disclosed utilizing graphs and logs as part of the report (refer to Col 21, Lines 1- 
15). 

At the time of the invention, it would have been obvious to a person of ordinary skill in the art to 
combine the Sharon and Sistanizadeh since Sharon disclosed the important of utilizing the 
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reports to present the monitored data and furthermore by utilizing Sistanizadeh's system, it 
provides better interface for customer to understand the network better. 
The suggestion/motivation would have been the by incorporate graphs and logs within the 
reports, provides conveniences to the user to understand the data more clearly. 



Conclusion 

Examiner's Notes: Examiner has cited particular columns and line numbers in the 
references applied to the claims above for the convenience of the applicant. Although the 
specified citations are representative of the teachings of the art and are applied to specific 
limitations within the individual claim, other passages and figures may apply as well. It is 
respectfully requested from the applicant in preparing responses, to fully consider the references 
in entirety as potentially teaching all or part of the claimed invention, as well as the context of 
the passage as taught by the prior art or disclosed by the Examiner. In the case of amending the 
claimed invention, Applicant is respectfully requested to indicate the portion(s) of the 
specification which dictate(s) the structure relied on for proper interpretation and also to verify 
and ascertain the metes and bounds of the claimed invention. 

Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
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the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Karen C. Tang whose telephone number is (571)272-3 116. The 
examiner can normally be reached on M-F 7-3. 

If attempts to reach the examiner by telephone arc unsuccessful, the examiner's 
supervisor, John Follansbee can be reached on (571)272-3964. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



KT 

/John Follansbee/ 

Supervisory Patent Examiner, Art Unit 2151 
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